Export limit exceeded: 424983 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 424983 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (424983 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-124009 | 2026-11-12 | 7.2 High | ||
| XWEB EVO 5.2.3 through 5.8.8 contains an authenticated OS command injection vulnerability that allows authenticated attackers to execute arbitrary commands as root by injecting shell metacharacters into the output device path parameter processed by backup.lua. Attackers can exploit the unescaped concatenation into mount, unzip, and related shell commands run via the wlua interpreter, including through the setuid xwbackup.cgi and xwrestore.cgi interfaces, to achieve full system compromise. This product line reached it's end of service date in March 2026. | ||||
| CVE-2026-114594 | 1 Sandisk | 1 Dashboard | 2026-11-12 | N/A |
| A time-of-check to time-of-use (TOCTOU) race condition in the Sandisk Dashboard installer allows a local, authenticated standard user to replace an installer-staged binary in a user-writable temporary directory between validation and execution. The elevated installer then executes the attacker-controlled binary, resulting in local privilege escalation to a high-integrity (administrative) context. This issue affects Sandisk Dashboard through 5.2.2.3. | ||||
| CVE-2026-12977 | 1 Redhat | 7 Fuze 7, Jboss Enterprise Application Platform, Jboss Enterprise Application Platform Expansion Pack and 4 more | 2026-11-12 | 8.8 High |
| A flaw was found in the deployment-operation family of WildFly Core. Certain handlers, such as upload-deployment-url, lack proper sensitivity classification, allowing an administrator with the restricted "Maintainer" role to read sensitive configuration files. This can lead to the exfiltration of credentials and full administrative control (SuperUser) of the server. | ||||
| CVE-2026-122056 | 3 Openscap, Red Hat, Redhat | 6 Openscap, Enterprise Linux, Enterprise Linux and 3 more | 2026-11-12 | 5.9 Medium |
| A flaw was found in OpenSCAP. A heap-based buffer overflow can occur when processing a specially crafted Extensible Configuration Checklist Description Format (XCCDF) document using the sds-compose option. An attacker could exploit this vulnerability to corrupt memory, resulting in an application crash and a Denial of Service (DoS). | ||||
| CVE-2026-115864 | 1 Kazeburo | 1 Monoceros | 2026-11-12 | 7.5 High |
| Monoceros versions before 0.30 for Perl allow a request declaring a large Content-Length to kill a worker by exhausting memory. The request body is read in a loop that asks sysread for all of the remaining declared length at once. Perl grows the read buffer to that size before any data arrives, so a length larger than available memory makes the worker exit with an uncatchable out of memory error before the application is called. A remote attacker can force a worker restart with each request of a few bytes. | ||||
| CVE-2026-125114 | 1 Novu | 1 Novu | 2026-11-12 | N/A |
| Novu provides an API for sending notifications through multiple channels. Prior to 3.15.0, the conditions filter webhook in libs/application-generic/src/usecases/conditions-filter/conditions-filter.usecase.ts passes the user-configured child.webhookUrl directly to axios.post without calling validateUrlSsrf. Evaluating a workflow condition can therefore make the worker send a POST request to a private or link-local service and return the response data for condition evaluation. The response is stored in execution details and exposed through GET /execution-details, which can disclose credentials from POST-capable metadata services or data from internal services, although metadata endpoints that require GET are not reachable through this path. This issue is fixed in version 3.15.0. | ||||
| CVE-2026-124008 | 2026-11-12 | 7.2 High | ||
| XWEB EVO 5.2.3 through 5.8.8 contains an authenticated OS command injection vulnerability in the devices.lua template handling, which allows authenticated attackers to execute arbitrary commands by injecting unescaped template source into unzip and related shell commands. Attackers can exploit this flaw through the wlua interpreter to execute arbitrary commands with root privileges on the affected device. This product line reached it's end of service date in March 2026. | ||||
| CVE-2026-125115 | 1 Novu | 2 Application-generic, Novu | 2026-11-12 | 6.8 Medium |
| Novu provides an API for sending notifications through multiple channels. Prior to 3.17.0, validateUrlSsrf in libs/application-generic/src/utils/ssrf-url-validation.ts uses the isPrivateIp deny-list without covering the RFC6598 100.64.0.0/10 shared address space or its IPv4-mapped IPv6 forms. The workflow HTTP request step and webhook filter condition can therefore send server-side requests when a configured literal address or resolved hostname falls in that range. In Alibaba Cloud, 100.100.100.200 may expose instance metadata, while self-hosted and multi-tenant deployments may expose provider-internal services, private infrastructure, service meshes, or VPN resources reachable through CGNAT addressing. This issue is fixed in version 3.17.0. | ||||
| CVE-2026-125378 | 1 Powerdns-admin | 1 Powerdns-admin | 2026-11-12 | 4.3 Medium |
| PowerDNS-Admin before 2026.11.0 contains a missing authorization vulnerability in the apply_records handler for /admin/template/<template>/apply that lets any authenticated User-role account modify shared zone templates. Attackers can replace a template's record set by name, injecting attacker-chosen NS, MX, A or CNAME records into every zone later created from it. | ||||
| CVE-2026-125393 | 1 Mailenable | 1 Mailenable Enterprise Premium | 2026-11-12 | 6.5 Medium |
| MailEnable Enterprise Premium before 10.62 contains a heap overflow vulnerability in the IMAP X-FB-FETCH command that allows authenticated users to overflow a fixed 0x400-byte heap buffer. Attackers can supply an X-FB-USER address longer than about 1016 bytes, which is formatted without a length check, to crash the IMAP service and cause denial of service. | ||||
| CVE-2026-125396 | 2 Artifex, Artifex Software Inc. | 3 Ghostpdl, Ghostscript, Ghostscript | 2026-11-12 | 7.8 High |
| Ghostscript before 10.08.0 contains a -dSAFER bypass vulnerability in the .putgstringcopy procedure in gs_fonts.ps, which calls the privileged .forceput operator without checking operand types. Attackers can supply crafted PostScript or PDF documents that trigger a type error, recover .forceput via a custom error handler, and cause a use-after-free across save/restore to execute arbitrary code. | ||||
| CVE-2026-124007 | 2026-11-12 | 8.1 High | ||
| XWEB EVO before 5.6.2 contains a pre-authentication OS command injection vulnerability that allows unauthenticated remote attackers to execute arbitrary commands by injecting shell metacharacters into the password field. Attackers can exploit the unescaped interpolation of the password value into the hashpass invocation within login.lua, cleanout.lua, and api.lua to achieve root-level command execution via the setuid wlua interpreter. This product line reached it's end of service date in March 2026. | ||||
| CVE-2026-76964 | 1 Sap Se | 1 Sap Netweaver And Abap Platform | 2026-11-12 | 10 Critical |
| SAP NetWeaver Application Server ABAP does not sufficiently validate certain network input processed by an internal component. An unauthenticated attacker could send specially crafted network traffic to trigger a memory corruption condition in the affected functionality. Successful exploitation could allow the attacker to execute arbitrary code and fully compromise the system, resulting in a high impact on confidentiality, integrity and availability of the system. | ||||
| CVE-2026-76973 | 1 Sap Se | 1 Sap Netweaver And Abap Platform | 2026-11-12 | 7.5 High |
| Due to a Memory Corruption vulnerability in Application Server ABAP of SAP NetWeaver and ABAP Platform, an unauthenticated attacker could send specially crafted network requests to the affected service. By triggering the vulnerability, the attacker could cause the server to crash and disrupt active connections, leading to a denial of service condition. Successful exploitation could result in a high impact to the availability while the confidentiality and integrity remains unaffected. | ||||
| CVE-2026-121669 | 1 Microsoft | 3 Powershell, Powershell 7.6, Powershell 7.7 | 2026-11-12 | 6.1 Medium |
| Insufficiently protected credentials in Microsoft PowerShell Core allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-121675 | 1 Microsoft | 3 Powershell, Powershell 7.6, Powershell 7.7 | 2026-11-12 | 6.1 Medium |
| Improper restriction of xml external entity reference in Microsoft PowerShell allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-124016 | 1 Postalsys | 1 Postal-mime | 2026-11-12 | 5.3 Medium |
| postal-mime before 4.2.1 contains an algorithmic complexity denial of service vulnerability that allows unauthenticated remote attackers to cause excessive CPU consumption in the PostalMime.processLine() function by crafting deeply nested multipart email messages with boundary lines sharing long prefixes with open boundaries. Attackers can deliver a malicious email with nesting up to the default maxNestingDepth of 256, causing per-line parsing cost to scale as O(depth x shared prefix length) and blocking the Node.js event loop for seconds per message. | ||||
| CVE-2026-124006 | 2026-11-12 | 8.1 High | ||
| XWEB EVO through 5.8.8 contains a predictable credential generation vulnerability that allows attackers to derive the Linux root password by computing a fixed prefix combined with a daily password value. Attackers can calculate the deterministic root credential, which before 5.7.0 was identical across all units and from 5.7.0 onward remains derivable from the MAC-based daily password, to gain unauthorized root access to the underlying operating system. This product line reached it's end of service date in March 2026. | ||||
| CVE-2026-105986 | 1 Konghq | 2 Kong Ai Gateway, Kong Gateway Enterprise | 2026-11-12 | N/A |
| Incorrect authorization in the Admin API RBAC of Kong Gateway Enterprise allows a delegated administrator to elevate privileges via a percent-encoded role name or a self-assigned role. | ||||
| CVE-2026-107372 | 1 Auth0 | 1 Auth0 Ai Js | 2026-11-12 | N/A |
| The auth0-ai-js FGA retriever does not distinguish between authorization checks under different conditions when filtering documents during retrieval-augmented generation, resulting in documents denied by Auth0 FGA being included in the model context and used in the generated response. | ||||